Keeping email and files safe when staff leave

Why leavers are a data risk

When someone leaves, a lot of business information leaves their daily care: client emails, quotes, half-finished projects, notes in their OneDrive and files saved on their laptop. If the account is simply deleted, Microsoft 365 and Google Workspace keep it only for a limited period before removing it permanently. Months later, when a client disputes an invoice or asks about a conversation from last year, the evidence has gone.

There is also a security risk in the opposite direction. Accounts that are left active for convenience can still be signed in to, sometimes from the former employee's phone. Shared passwords, saved logins and access to cloud apps can linger for years unless someone removes them deliberately. A leaver who departed on bad terms is the obvious worry, but even an amicable departure leaves risk if their phone is later lost or their personal email is compromised.

Decide what happens to the mailbox

There are three common choices. Convert the mailbox to a shared mailbox, which keeps the email and lets named colleagues access it without a paid licence, within the size limits your plan allows. Delegate access to a manager for a set period so they can pick up client conversations. Or export the mailbox into a backup or archive and then delete the account.

Whichever you choose, set up mail forwarding or an automatic reply so clients writing to the old address reach someone. Decide how long that continues and put a date in the calendar to review it, rather than letting forwarding run indefinitely and confuse people. Forwarding to a personal address outside the business should never be used, because it sends client information somewhere you no longer control.

Handle OneDrive, Drive and the laptop

Files in a leaver's OneDrive or My Drive often include work that should be in a shared location. Before removing the account, have their manager review the contents and move anything important into the right SharePoint site or shared drive. In Microsoft 365, you can give a manager access to the leaver's OneDrive for a period; in Workspace, Drive ownership can be transferred to another user.

Collect the laptop and phone promptly. Before wiping the laptop, check for files saved locally on the Desktop or in Downloads, and confirm the backup holds a final copy. Then reset the device for its next user and record that it was returned. If staff use personal phones for work email, remove the company account and data from those phones through device management rather than asking the person to do it themselves.

The role of your backup

A good cloud backup makes leavers much easier. Most Microsoft 365 and Workspace backup services keep a former user's data after the account is deleted, often for as long as you choose. That means you can capture a final copy, release the licence and still restore an old email or file years later if needed.

Check how your provider handles this, and whether it charges for retaining former users. Some plans count leavers as active users while their data is kept, which is worth knowing when you budget. Make the final backup a checklist step, not an assumption. Run a quick test restore of one item from the leaver's data before deleting the account, so you know the copy is usable.

A simple leaver checklist

On or before the last day: confirm the backup has a recent complete copy; decide on the mailbox approach; move important files to shared locations; set forwarding or an auto-reply; collect devices. At the time they leave: disable sign-in, reset the password, sign the account out of all sessions, remove multi-factor methods and remove them from groups, shared mailboxes and cloud apps such as accounting or CRM.

Afterwards: remove or reassign the licence, update any shared passwords they knew, remove them from the website, phone system and building access, and note the date each step was done. Keep the record. If a dispute arises later, it shows the business acted promptly and responsibly. Managers should also tell IT about leavers as early as possible, ideally when notice is given, so the steps can be planned rather than rushed on the last afternoon.

Privacy and personal information

Former employees' mailboxes may contain personal emails and information about other people. Under the Privacy Act 2020, the business should keep personal information only as long as it needs it, for a lawful purpose. Decide how long you keep leavers' data, write it down, and apply it consistently rather than keeping everything forever by default.

If a former employee asks for access to their personal information, you may need to search their old mailbox to respond. Having it in a well-organised backup or archive, rather than scattered across old laptops, makes that much simpler. The same applies to any request from a lawyer or the Employment Relations Authority during a dispute, where a quick, complete search can matter a great deal.